@geminixiang/mikan 1.0.0-beta.7 → 1.0.0-beta.71

package/dist/harness/execution-env.js

@@ -0,0 +1,262 @@
+import { randomBytes } from "node:crypto";
+import { posix } from "node:path";
+import { DEFAULT_MAX_BYTES, DEFAULT_MAX_LINES, ExecutionError, FileError, err, ok, truncateHead, truncateTail, } from "@earendil-works/pi-agent-core";
+import { NodeExecutionEnv } from "@earendil-works/pi-agent-core/node";
+import { shellEscape } from "../sandbox/utils.js";
+/** Bash output spill directory, relative to the runtime workspace root. */
+const SPILL_DIR = ".mikan/bash-output";
+/** Matches the sandbox executor's own write chunking. */
+const WRITE_CHUNK_CHARS = 65536;
+/**
+ * pi's harness tools address files through an {@link ExecutionEnv}. mikan's
+ * `Executor` is the sandbox transport, so this bridges the two:
+ *
+ * - `host` uses pi's own `NodeExecutionEnv` — the host executor is plain node
+ *   fs + spawn, so there is nothing to adapt.
+ * - container / cloudflare are reached only through `exec`, so every file op
+ *   is a shell round-trip over the executor. The methods pi's four tools
+ *   actually call (`absolutePath`, `exists`, `readTextFile`, `readBinaryFile`,
+ *   `writeFile`, `fileInfo`, `exec`) delegate to the executor's existing
+ *   correct transports; the rest are shell fallbacks.
+ *
+ * The executor passed here is mikan's stable wrapper, which delegates to the
+ * actor-resolved executor at call time, so one env serves every run.
+ */
+export function createSandboxExecutionEnv(executor, sandboxType, runtimeWorkspaceRoot) {
+    if (sandboxType === "host") {
+        return new NodeExecutionEnv({ cwd: process.cwd() });
+    }
+    return new ShellExecutionEnv(executor, runtimeWorkspaceRoot);
+}
+class ShellExecutionEnv {
+    constructor(executor, runtimeWorkspaceRoot) {
+        this.executor = executor;
+        this.cwd = runtimeWorkspaceRoot;
+    }
+    async absolutePath(path, _context) {
+        return ok(posix.isAbsolute(path) ? posix.normalize(path) : posix.resolve(this.cwd, path));
+    }
+    async joinPath(parts, _context) {
+        return ok(posix.join(...parts));
+    }
+    readTextFile(path, context) {
+        return this.fileOp(() => this.executor.readFile(path, this.execOptions(context)));
+    }
+    async readBinaryFile(path, context) {
+        return this.fileOp(async () => Buffer.from(await this.executor.readFileBase64(path, this.execOptions(context)), "base64"));
+    }
+    readTextLines(path, options, context) {
+        return this.fileOp(async () => {
+            const max = options?.maxLines;
+            const command = max === undefined
+                ? `cat ${shellEscape(path)}`
+                : `head -n ${Math.max(0, Math.floor(max))} ${shellEscape(path)}`;
+            const { stdout } = await this.run(command, context);
+            const lines = stdout.split("\n");
+            if (lines.at(-1) === "")
+                lines.pop();
+            return lines;
+        });
+    }
+    writeFile(path, content, context) {
+        return this.fileOp(async () => {
+            if (typeof content === "string") {
+                await this.executor.writeFile(path, content, this.execOptions(context));
+                return;
+            }
+            await this.writeBase64(path, Buffer.from(content).toString("base64"), context);
+        });
+    }
+    appendFile(path, content, context) {
+        return this.fileOp(async () => {
+            const base64 = Buffer.from(content).toString("base64");
+            const stage = `${path}.mikan-append.b64`;
+            await this.run(`mkdir -p ${shellEscape(posix.dirname(path))} && : > ${shellEscape(stage)}`, context);
+            await this.appendBase64Chunks(stage, base64, context);
+            await this.run(`base64 -d < ${shellEscape(stage)} >> ${shellEscape(path)} && rm -f ${shellEscape(stage)}`, context);
+        });
+    }
+    renameFile(sourcePath, destinationPath, context) {
+        return this.fileOp(async () => {
+            await this.run(`mv -f ${shellEscape(sourcePath)} ${shellEscape(destinationPath)}`, context);
+        });
+    }
+    fileInfo(path, context) {
+        return this.fileOp(async () => {
+            const escaped = shellEscape(path);
+            const probe = await this.executor.exec(`if [ -L ${escaped} ]; then printf 'symlink'; elif [ -d ${escaped} ]; then printf 'directory'; ` +
+                `elif [ -f ${escaped} ]; then printf 'file'; else exit 1; fi`, this.execOptions(context));
+            if (probe.code !== 0)
+                throw new Error(`No such file or directory: ${path}`);
+            const kind = probe.stdout.trim();
+            let size = 0;
+            if (kind === "file") {
+                const stat = await this.executor.exec(`wc -c < ${escaped}`, this.execOptions(context));
+                if (stat.code === 0)
+                    size = Number.parseInt(stat.stdout.trim(), 10) || 0;
+            }
+            let mtimeMs = 0;
+            const mtime = await this.executor.exec(`date -r ${escaped} +%s`, this.execOptions(context));
+            if (mtime.code === 0)
+                mtimeMs = (Number.parseInt(mtime.stdout.trim(), 10) || 0) * 1000;
+            return { name: posix.basename(path), path, kind, size, mtimeMs };
+        });
+    }
+    async listDir(path, context) {
+        return this.fileOp(async () => {
+            const { stdout } = await this.run(`ls -A ${shellEscape(path)}`, context);
+            const names = stdout.split("\n").filter(Boolean).toSorted();
+            const entries = [];
+            for (const name of names) {
+                const child = posix.join(path, name);
+                const info = await this.fileInfo(child, context);
+                if (info.ok)
+                    entries.push(info.value);
+            }
+            return entries;
+        });
+    }
+    canonicalPath(path, context) {
+        return this.fileOp(async () => (await this.run(`realpath ${shellEscape(path)}`, context)).stdout.trim());
+    }
+    async exists(path, context) {
+        try {
+            const result = await this.executor.exec(`test -e ${shellEscape(path)}`, this.execOptions(context));
+            return ok(result.code === 0);
+        }
+        catch (error) {
+            return err(toFileError(error));
+        }
+    }
+    createDir(path, options, context) {
+        return this.fileOp(async () => {
+            const flag = options?.recursive === false ? "" : "-p ";
+            await this.run(`mkdir ${flag}${shellEscape(path)}`, context);
+        });
+    }
+    remove(path, options, context) {
+        return this.fileOp(async () => {
+            const recursive = options?.recursive ? "-r" : "";
+            const force = options?.force ? "-f" : "";
+            await this.run(`rm ${recursive} ${force} ${shellEscape(path)}`, context);
+        });
+    }
+    createTempDir(prefix, context) {
+        return this.fileOp(async () => {
+            const template = prefix === undefined ? "" : shellEscape(`${prefix}XXXXXX`);
+            const { stdout } = await this.run(`mktemp -d ${template}`.trim(), context);
+            return stdout.trim();
+        });
+    }
+    createTempFile(options, context) {
+        return this.fileOp(async () => {
+            const template = options?.prefix === undefined && options?.suffix === undefined
+                ? ""
+                : shellEscape(`${options?.prefix ?? ""}XXXXXX${options?.suffix ?? ""}`);
+            const { stdout } = await this.run(`mktemp ${template}`.trim(), context);
+            return stdout.trim();
+        });
+    }
+    async cleanup(_context) {
+        // The sandbox executor owns process lifetime; nothing to release here.
+    }
+    async exec(command, options, context) {
+        try {
+            const result = await this.executor.exec(command, {
+                ...(options?.cwd ? { cwd: options.cwd } : {}),
+                ...(options?.timeout ? { timeout: options.timeout } : {}),
+                signal: context.abortSignal,
+            });
+            const combined = [result.stdout, result.stderr].filter((part) => part.length > 0).join("\n");
+            const limits = options?.capture?.limits ?? {
+                maxBytes: DEFAULT_MAX_BYTES,
+                maxLines: DEFAULT_MAX_LINES,
+                retain: "tail",
+            };
+            const truncation = limits.retain === "head"
+                ? truncateHead(combined, { maxLines: limits.maxLines, maxBytes: limits.maxBytes })
+                : truncateTail(combined, { maxLines: limits.maxLines, maxBytes: limits.maxBytes });
+            let spillPath;
+            if (options?.capture?.spill && truncation.truncated) {
+                try {
+                    spillPath = posix.join(this.cwd, SPILL_DIR, `${randomBytes(8).toString("hex")}.log`);
+                    await this.executor.writeFile(spillPath, combined, this.execOptions(context));
+                }
+                catch {
+                    spillPath = undefined;
+                }
+            }
+            const metadata = shellOutputMetadata(truncation, spillPath);
+            options?.onUpdate?.({ kind: "replace", output: { text: truncation.content, ...metadata } }, context);
+            return ok({ exitCode: result.code, ...metadata });
+        }
+        catch (error) {
+            return err(toExecutionError(error, context));
+        }
+    }
+    execOptions(context) {
+        return { signal: context.abortSignal };
+    }
+    async run(command, context) {
+        const result = await this.executor.exec(command, this.execOptions(context));
+        if (result.code !== 0) {
+            throw new Error(result.stderr.trim() || `Command failed (${result.code}): ${command}`);
+        }
+        return result;
+    }
+    async writeBase64(path, base64, context) {
+        const stage = `${path}.mikan-stage`;
+        const stageB64 = `${path}.mikan-stage.b64`;
+        await this.run(`mkdir -p ${shellEscape(posix.dirname(path))} && : > ${shellEscape(stageB64)}`, context);
+        await this.appendBase64Chunks(stageB64, base64, context);
+        await this.run(`base64 -d < ${shellEscape(stageB64)} > ${shellEscape(stage)} && mv ${shellEscape(stage)} ` +
+            `${shellEscape(path)} && rm -f ${shellEscape(stageB64)}`, context);
+    }
+    async appendBase64Chunks(targetB64, base64, context) {
+        for (let offset = 0; offset === 0 || offset < base64.length; offset += WRITE_CHUNK_CHARS) {
+            const chunk = base64.slice(offset, offset + WRITE_CHUNK_CHARS);
+            await this.run(`printf '%s' ${shellEscape(chunk)} >> ${shellEscape(targetB64)}`, context);
+        }
+    }
+    async fileOp(op) {
+        try {
+            return ok(await op());
+        }
+        catch (error) {
+            return err(toFileError(error));
+        }
+    }
+}
+function shellOutputMetadata(truncation, spillPath) {
+    const { content: _content, ...metadata } = truncation;
+    const lastLine = truncation.content.split("\n").at(-1) ?? "";
+    return {
+        truncation: metadata,
+        ...(spillPath ? { spillPath } : {}),
+        ...(truncation.lastLinePartial ? { lastLineBytes: Buffer.byteLength(lastLine, "utf8") } : {}),
+    };
+}
+function toFileError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (/aborted/i.test(message))
+        return new FileError("aborted", message);
+    if (/no such file|not found/i.test(message))
+        return new FileError("not_found", message);
+    if (/permission denied/i.test(message))
+        return new FileError("permission_denied", message);
+    if (/not a directory/i.test(message))
+        return new FileError("not_directory", message);
+    if (/is a directory/i.test(message))
+        return new FileError("is_directory", message);
+    return new FileError("unknown", message, undefined, error instanceof Error ? error : undefined);
+}
+function toExecutionError(error, context) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (context.abortSignal?.aborted || /aborted/i.test(message)) {
+        return new ExecutionError("aborted", message);
+    }
+    if (/timed out/i.test(message))
+        return new ExecutionError("timeout", message);
+    return new ExecutionError("unknown", message, error instanceof Error ? error : undefined);
+}
+//# sourceMappingURL=execution-env.js.map

package/dist/harness/execution-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-env.js","sourceRoot":"","sources":["../../src/harness/execution-env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,SAAS,EACT,GAAG,EACH,EAAE,EACF,YAAY,EACZ,YAAY,GAUb,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAEtE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,2EAA2E;AAC3E,MAAM,SAAS,GAAG,oBAAoB,CAAC;AAEvC,yDAAyD;AACzD,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAkB,EAClB,WAAkC,EAClC,oBAA4B;IAE5B,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,IAAI,gBAAgB,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,iBAAiB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,iBAAiB;IAGrB,YACmB,QAAkB,EACnC,oBAA4B;wBADX,QAAQ;QAGzB,IAAI,CAAC,GAAG,GAAG,oBAAoB,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,QAAiB;QAChD,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5F,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAe,EAAE,QAAiB;QAC/C,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;IAClC,CAAC;IAED,YAAY,CAAC,IAAY,EAAE,OAAgB;QACzC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,IAAY,EAAE,OAAgB;QACjD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAC5B,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,CAC3F,CAAC;IACJ,CAAC;IAED,aAAa,CACX,IAAY,EACZ,OAA0C,EAC1C,OAAgB;QAEhB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,GAAG,GAAG,OAAO,EAAE,QAAQ,CAAC;YAC9B,MAAM,OAAO,GACX,GAAG,KAAK,SAAS;gBACf,CAAC,CAAC,OAAO,WAAW,CAAC,IAAI,CAAC,EAAE;gBAC5B,CAAC,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACpD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;gBAAE,KAAK,CAAC,GAAG,EAAE,CAAC;YACrC,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CACP,IAAY,EACZ,OAA4B,EAC5B,OAAgB;QAEhB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;QACjF,CAAC,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CACR,IAAY,EACZ,OAA4B,EAC5B,OAAgB;QAEhB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,GAAG,IAAI,mBAAmB,CAAC;YACzC,MAAM,IAAI,CAAC,GAAG,CACZ,YAAY,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,WAAW,CAAC,KAAK,CAAC,EAAE,EAC3E,OAAO,CACR,CAAC;YACF,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YACtD,MAAM,IAAI,CAAC,GAAG,CACZ,eAAe,WAAW,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,IAAI,CAAC,aAAa,WAAW,CAAC,KAAK,CAAC,EAAE,EAC1F,OAAO,CACR,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CACR,UAAkB,EAClB,eAAuB,EACvB,OAAgB;QAEhB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,WAAW,CAAC,UAAU,CAAC,IAAI,WAAW,CAAC,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC9F,CAAC,CAAC,CAAC;IACL,CAAC;IAED,QAAQ,CAAC,IAAY,EAAE,OAAgB;QACrC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CACpC,WAAW,OAAO,wCAAwC,OAAO,+BAA+B;gBAC9F,aAAa,OAAO,yCAAyC,EAC/D,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAC1B,CAAC;YACF,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;YAC5E,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAc,CAAC;YAC7C,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,OAAO,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;gBACvF,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;oBAAE,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3E,CAAC;YACD,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,OAAO,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5F,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;YACvF,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,OAAgB;QAC1C,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACzE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC5D,MAAM,OAAO,GAAe,EAAE,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACjD,IAAI,IAAI,CAAC,EAAE;oBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxC,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,aAAa,CAAC,IAAY,EAAE,OAAgB;QAC1C,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAC5B,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CACzE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,OAAgB;QACzC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CACrC,WAAW,WAAW,CAAC,IAAI,CAAC,EAAE,EAC9B,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAC1B,CAAC;YACF,OAAO,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,SAAS,CACP,IAAY,EACZ,OAA4C,EAC5C,OAAgB;QAEhB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,IAAI,GAAG,OAAO,EAAE,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YACvD,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CACJ,IAAY,EACZ,OAA6D,EAC7D,OAAgB;QAEhB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,SAAS,IAAI,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,aAAa,CAAC,MAA0B,EAAE,OAAgB;QACxD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,QAAQ,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,MAAM,QAAQ,CAAC,CAAC;YAC5E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;YAC3E,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CACZ,OAAyD,EACzD,OAAgB;QAEhB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,QAAQ,GACZ,OAAO,EAAE,MAAM,KAAK,SAAS,IAAI,OAAO,EAAE,MAAM,KAAK,SAAS;gBAC5D,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,WAAW,CAAC,GAAG,OAAO,EAAE,MAAM,IAAI,EAAE,SAAS,OAAO,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;YAC5E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;YACxE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAiB;QAC7B,uEAAuE;IACzE,CAAC;IAED,KAAK,CAAC,IAAI,CACR,OAAe,EACf,OAAqC,EACrC,OAAgB;QAEhB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE;gBAC/C,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,MAAM,EAAE,OAAO,CAAC,WAAW;aAC5B,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7F,MAAM,MAAM,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI;gBACzC,QAAQ,EAAE,iBAAiB;gBAC3B,QAAQ,EAAE,iBAAiB;gBAC3B,MAAM,EAAE,MAAe;aACxB,CAAC;YACF,MAAM,UAAU,GACd,MAAM,CAAC,MAAM,KAAK,MAAM;gBACtB,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAClF,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YAEvF,IAAI,SAA6B,CAAC;YAClC,IAAI,OAAO,EAAE,OAAO,EAAE,KAAK,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;gBACpD,IAAI,CAAC;oBACH,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBACrF,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;gBAChF,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS,GAAG,SAAS,CAAC;gBACxB,CAAC;YACH,CAAC;YAED,MAAM,QAAQ,GAAG,mBAAmB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;YAC5D,OAAO,EAAE,QAAQ,EAAE,CACjB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,GAAG,QAAQ,EAAE,EAAE,EACtE,OAAO,CACR,CAAC;YACF,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,GAAG,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,OAAgB;QAClC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;IACzC,CAAC;IAEO,KAAK,CAAC,GAAG,CACf,OAAe,EACf,OAAgB;QAEhB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5E,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,mBAAmB,MAAM,CAAC,IAAI,MAAM,OAAO,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,IAAY,EAAE,MAAc,EAAE,OAAgB;QACtE,MAAM,KAAK,GAAG,GAAG,IAAI,cAAc,CAAC;QACpC,MAAM,QAAQ,GAAG,GAAG,IAAI,kBAAkB,CAAC;QAC3C,MAAM,IAAI,CAAC,GAAG,CACZ,YAAY,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,WAAW,CAAC,QAAQ,CAAC,EAAE,EAC9E,OAAO,CACR,CAAC;QACF,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACzD,MAAM,IAAI,CAAC,GAAG,CACZ,eAAe,WAAW,CAAC,QAAQ,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC,UAAU,WAAW,CAAC,KAAK,CAAC,GAAG;YACzF,GAAG,WAAW,CAAC,IAAI,CAAC,aAAa,WAAW,CAAC,QAAQ,CAAC,EAAE,EAC1D,OAAO,CACR,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,SAAiB,EACjB,MAAc,EACd,OAAgB;QAEhB,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,KAAK,CAAC,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,iBAAiB,EAAE,CAAC;YACzF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAAC,CAAC;YAC/D,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,WAAW,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAM,CAAI,EAAoB;QAC1C,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;CACF;AAED,SAAS,mBAAmB,CAC1B,UAA4B,EAC5B,SAA6B;IAE7B,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,GAAG,UAAU,CAAC;IACtD,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,OAAO;QACL,UAAU,EAAE,QAAQ;QACpB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9F,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACvE,IAAI,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACxF,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,SAAS,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAC3F,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACrF,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,SAAS,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACnF,OAAO,IAAI,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,OAAgB;IACxD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,OAAO,CAAC,WAAW,EAAE,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7D,OAAO,IAAI,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC9E,OAAO,IAAI,cAAc,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAC5F,CAAC","sourcesContent":["import { randomBytes } from \"node:crypto\";\nimport { posix } from \"node:path\";\nimport {\n  DEFAULT_MAX_BYTES,\n  DEFAULT_MAX_LINES,\n  ExecutionError,\n  FileError,\n  err,\n  ok,\n  truncateHead,\n  truncateTail,\n  type Context,\n  type ExecutionEnv,\n  type FileInfo,\n  type FileKind,\n  type Result,\n  type ShellExecOptions,\n  type ShellExecResult,\n  type ShellOutputMetadata,\n  type TruncationResult,\n} from \"@earendil-works/pi-agent-core\";\nimport { NodeExecutionEnv } from \"@earendil-works/pi-agent-core/node\";\nimport type { Executor, SandboxConfig } from \"../sandbox/index.js\";\nimport { shellEscape } from \"../sandbox/utils.js\";\n\n/** Bash output spill directory, relative to the runtime workspace root. */\nconst SPILL_DIR = \".mikan/bash-output\";\n\n/** Matches the sandbox executor's own write chunking. */\nconst WRITE_CHUNK_CHARS = 65536;\n\n/**\n * pi's harness tools address files through an {@link ExecutionEnv}. mikan's\n * `Executor` is the sandbox transport, so this bridges the two:\n *\n * - `host` uses pi's own `NodeExecutionEnv` — the host executor is plain node\n *   fs + spawn, so there is nothing to adapt.\n * - container / cloudflare are reached only through `exec`, so every file op\n *   is a shell round-trip over the executor. The methods pi's four tools\n *   actually call (`absolutePath`, `exists`, `readTextFile`, `readBinaryFile`,\n *   `writeFile`, `fileInfo`, `exec`) delegate to the executor's existing\n *   correct transports; the rest are shell fallbacks.\n *\n * The executor passed here is mikan's stable wrapper, which delegates to the\n * actor-resolved executor at call time, so one env serves every run.\n */\nexport function createSandboxExecutionEnv(\n  executor: Executor,\n  sandboxType: SandboxConfig[\"type\"],\n  runtimeWorkspaceRoot: string,\n): ExecutionEnv {\n  if (sandboxType === \"host\") {\n    return new NodeExecutionEnv({ cwd: process.cwd() });\n  }\n  return new ShellExecutionEnv(executor, runtimeWorkspaceRoot);\n}\n\nclass ShellExecutionEnv implements ExecutionEnv {\n  readonly cwd: string;\n\n  constructor(\n    private readonly executor: Executor,\n    runtimeWorkspaceRoot: string,\n  ) {\n    this.cwd = runtimeWorkspaceRoot;\n  }\n\n  async absolutePath(path: string, _context: Context): Promise<Result<string, FileError>> {\n    return ok(posix.isAbsolute(path) ? posix.normalize(path) : posix.resolve(this.cwd, path));\n  }\n\n  async joinPath(parts: string[], _context: Context): Promise<Result<string, FileError>> {\n    return ok(posix.join(...parts));\n  }\n\n  readTextFile(path: string, context: Context): Promise<Result<string, FileError>> {\n    return this.fileOp(() => this.executor.readFile(path, this.execOptions(context)));\n  }\n\n  async readBinaryFile(path: string, context: Context): Promise<Result<Uint8Array, FileError>> {\n    return this.fileOp(async () =>\n      Buffer.from(await this.executor.readFileBase64(path, this.execOptions(context)), \"base64\"),\n    );\n  }\n\n  readTextLines(\n    path: string,\n    options: { maxLines?: number } | undefined,\n    context: Context,\n  ): Promise<Result<string[], FileError>> {\n    return this.fileOp(async () => {\n      const max = options?.maxLines;\n      const command =\n        max === undefined\n          ? `cat ${shellEscape(path)}`\n          : `head -n ${Math.max(0, Math.floor(max))} ${shellEscape(path)}`;\n      const { stdout } = await this.run(command, context);\n      const lines = stdout.split(\"\\n\");\n      if (lines.at(-1) === \"\") lines.pop();\n      return lines;\n    });\n  }\n\n  writeFile(\n    path: string,\n    content: string | Uint8Array,\n    context: Context,\n  ): Promise<Result<void, FileError>> {\n    return this.fileOp(async () => {\n      if (typeof content === \"string\") {\n        await this.executor.writeFile(path, content, this.execOptions(context));\n        return;\n      }\n      await this.writeBase64(path, Buffer.from(content).toString(\"base64\"), context);\n    });\n  }\n\n  appendFile(\n    path: string,\n    content: string | Uint8Array,\n    context: Context,\n  ): Promise<Result<void, FileError>> {\n    return this.fileOp(async () => {\n      const base64 = Buffer.from(content).toString(\"base64\");\n      const stage = `${path}.mikan-append.b64`;\n      await this.run(\n        `mkdir -p ${shellEscape(posix.dirname(path))} && : > ${shellEscape(stage)}`,\n        context,\n      );\n      await this.appendBase64Chunks(stage, base64, context);\n      await this.run(\n        `base64 -d < ${shellEscape(stage)} >> ${shellEscape(path)} && rm -f ${shellEscape(stage)}`,\n        context,\n      );\n    });\n  }\n\n  renameFile(\n    sourcePath: string,\n    destinationPath: string,\n    context: Context,\n  ): Promise<Result<void, FileError>> {\n    return this.fileOp(async () => {\n      await this.run(`mv -f ${shellEscape(sourcePath)} ${shellEscape(destinationPath)}`, context);\n    });\n  }\n\n  fileInfo(path: string, context: Context): Promise<Result<FileInfo, FileError>> {\n    return this.fileOp(async () => {\n      const escaped = shellEscape(path);\n      const probe = await this.executor.exec(\n        `if [ -L ${escaped} ]; then printf 'symlink'; elif [ -d ${escaped} ]; then printf 'directory'; ` +\n          `elif [ -f ${escaped} ]; then printf 'file'; else exit 1; fi`,\n        this.execOptions(context),\n      );\n      if (probe.code !== 0) throw new Error(`No such file or directory: ${path}`);\n      const kind = probe.stdout.trim() as FileKind;\n      let size = 0;\n      if (kind === \"file\") {\n        const stat = await this.executor.exec(`wc -c < ${escaped}`, this.execOptions(context));\n        if (stat.code === 0) size = Number.parseInt(stat.stdout.trim(), 10) || 0;\n      }\n      let mtimeMs = 0;\n      const mtime = await this.executor.exec(`date -r ${escaped} +%s`, this.execOptions(context));\n      if (mtime.code === 0) mtimeMs = (Number.parseInt(mtime.stdout.trim(), 10) || 0) * 1000;\n      return { name: posix.basename(path), path, kind, size, mtimeMs };\n    });\n  }\n\n  async listDir(path: string, context: Context): Promise<Result<FileInfo[], FileError>> {\n    return this.fileOp(async () => {\n      const { stdout } = await this.run(`ls -A ${shellEscape(path)}`, context);\n      const names = stdout.split(\"\\n\").filter(Boolean).toSorted();\n      const entries: FileInfo[] = [];\n      for (const name of names) {\n        const child = posix.join(path, name);\n        const info = await this.fileInfo(child, context);\n        if (info.ok) entries.push(info.value);\n      }\n      return entries;\n    });\n  }\n\n  canonicalPath(path: string, context: Context): Promise<Result<string, FileError>> {\n    return this.fileOp(async () =>\n      (await this.run(`realpath ${shellEscape(path)}`, context)).stdout.trim(),\n    );\n  }\n\n  async exists(path: string, context: Context): Promise<Result<boolean, FileError>> {\n    try {\n      const result = await this.executor.exec(\n        `test -e ${shellEscape(path)}`,\n        this.execOptions(context),\n      );\n      return ok(result.code === 0);\n    } catch (error) {\n      return err(toFileError(error));\n    }\n  }\n\n  createDir(\n    path: string,\n    options: { recursive?: boolean } | undefined,\n    context: Context,\n  ): Promise<Result<void, FileError>> {\n    return this.fileOp(async () => {\n      const flag = options?.recursive === false ? \"\" : \"-p \";\n      await this.run(`mkdir ${flag}${shellEscape(path)}`, context);\n    });\n  }\n\n  remove(\n    path: string,\n    options: { recursive?: boolean; force?: boolean } | undefined,\n    context: Context,\n  ): Promise<Result<void, FileError>> {\n    return this.fileOp(async () => {\n      const recursive = options?.recursive ? \"-r\" : \"\";\n      const force = options?.force ? \"-f\" : \"\";\n      await this.run(`rm ${recursive} ${force} ${shellEscape(path)}`, context);\n    });\n  }\n\n  createTempDir(prefix: string | undefined, context: Context): Promise<Result<string, FileError>> {\n    return this.fileOp(async () => {\n      const template = prefix === undefined ? \"\" : shellEscape(`${prefix}XXXXXX`);\n      const { stdout } = await this.run(`mktemp -d ${template}`.trim(), context);\n      return stdout.trim();\n    });\n  }\n\n  createTempFile(\n    options: { prefix?: string; suffix?: string } | undefined,\n    context: Context,\n  ): Promise<Result<string, FileError>> {\n    return this.fileOp(async () => {\n      const template =\n        options?.prefix === undefined && options?.suffix === undefined\n          ? \"\"\n          : shellEscape(`${options?.prefix ?? \"\"}XXXXXX${options?.suffix ?? \"\"}`);\n      const { stdout } = await this.run(`mktemp ${template}`.trim(), context);\n      return stdout.trim();\n    });\n  }\n\n  async cleanup(_context: Context): Promise<void> {\n    // The sandbox executor owns process lifetime; nothing to release here.\n  }\n\n  async exec(\n    command: string,\n    options: ShellExecOptions | undefined,\n    context: Context,\n  ): Promise<Result<ShellExecResult, ExecutionError>> {\n    try {\n      const result = await this.executor.exec(command, {\n        ...(options?.cwd ? { cwd: options.cwd } : {}),\n        ...(options?.timeout ? { timeout: options.timeout } : {}),\n        signal: context.abortSignal,\n      });\n      const combined = [result.stdout, result.stderr].filter((part) => part.length > 0).join(\"\\n\");\n      const limits = options?.capture?.limits ?? {\n        maxBytes: DEFAULT_MAX_BYTES,\n        maxLines: DEFAULT_MAX_LINES,\n        retain: \"tail\" as const,\n      };\n      const truncation =\n        limits.retain === \"head\"\n          ? truncateHead(combined, { maxLines: limits.maxLines, maxBytes: limits.maxBytes })\n          : truncateTail(combined, { maxLines: limits.maxLines, maxBytes: limits.maxBytes });\n\n      let spillPath: string | undefined;\n      if (options?.capture?.spill && truncation.truncated) {\n        try {\n          spillPath = posix.join(this.cwd, SPILL_DIR, `${randomBytes(8).toString(\"hex\")}.log`);\n          await this.executor.writeFile(spillPath, combined, this.execOptions(context));\n        } catch {\n          spillPath = undefined;\n        }\n      }\n\n      const metadata = shellOutputMetadata(truncation, spillPath);\n      options?.onUpdate?.(\n        { kind: \"replace\", output: { text: truncation.content, ...metadata } },\n        context,\n      );\n      return ok({ exitCode: result.code, ...metadata });\n    } catch (error) {\n      return err(toExecutionError(error, context));\n    }\n  }\n\n  private execOptions(context: Context): { signal: AbortSignal | undefined } {\n    return { signal: context.abortSignal };\n  }\n\n  private async run(\n    command: string,\n    context: Context,\n  ): Promise<{ stdout: string; stderr: string }> {\n    const result = await this.executor.exec(command, this.execOptions(context));\n    if (result.code !== 0) {\n      throw new Error(result.stderr.trim() || `Command failed (${result.code}): ${command}`);\n    }\n    return result;\n  }\n\n  private async writeBase64(path: string, base64: string, context: Context): Promise<void> {\n    const stage = `${path}.mikan-stage`;\n    const stageB64 = `${path}.mikan-stage.b64`;\n    await this.run(\n      `mkdir -p ${shellEscape(posix.dirname(path))} && : > ${shellEscape(stageB64)}`,\n      context,\n    );\n    await this.appendBase64Chunks(stageB64, base64, context);\n    await this.run(\n      `base64 -d < ${shellEscape(stageB64)} > ${shellEscape(stage)} && mv ${shellEscape(stage)} ` +\n        `${shellEscape(path)} && rm -f ${shellEscape(stageB64)}`,\n      context,\n    );\n  }\n\n  private async appendBase64Chunks(\n    targetB64: string,\n    base64: string,\n    context: Context,\n  ): Promise<void> {\n    for (let offset = 0; offset === 0 || offset < base64.length; offset += WRITE_CHUNK_CHARS) {\n      const chunk = base64.slice(offset, offset + WRITE_CHUNK_CHARS);\n      await this.run(`printf '%s' ${shellEscape(chunk)} >> ${shellEscape(targetB64)}`, context);\n    }\n  }\n\n  private async fileOp<T>(op: () => Promise<T>): Promise<Result<T, FileError>> {\n    try {\n      return ok(await op());\n    } catch (error) {\n      return err(toFileError(error));\n    }\n  }\n}\n\nfunction shellOutputMetadata(\n  truncation: TruncationResult,\n  spillPath: string | undefined,\n): ShellOutputMetadata {\n  const { content: _content, ...metadata } = truncation;\n  const lastLine = truncation.content.split(\"\\n\").at(-1) ?? \"\";\n  return {\n    truncation: metadata,\n    ...(spillPath ? { spillPath } : {}),\n    ...(truncation.lastLinePartial ? { lastLineBytes: Buffer.byteLength(lastLine, \"utf8\") } : {}),\n  };\n}\n\nfunction toFileError(error: unknown): FileError {\n  const message = error instanceof Error ? error.message : String(error);\n  if (/aborted/i.test(message)) return new FileError(\"aborted\", message);\n  if (/no such file|not found/i.test(message)) return new FileError(\"not_found\", message);\n  if (/permission denied/i.test(message)) return new FileError(\"permission_denied\", message);\n  if (/not a directory/i.test(message)) return new FileError(\"not_directory\", message);\n  if (/is a directory/i.test(message)) return new FileError(\"is_directory\", message);\n  return new FileError(\"unknown\", message, undefined, error instanceof Error ? error : undefined);\n}\n\nfunction toExecutionError(error: unknown, context: Context): ExecutionError {\n  const message = error instanceof Error ? error.message : String(error);\n  if (context.abortSignal?.aborted || /aborted/i.test(message)) {\n    return new ExecutionError(\"aborted\", message);\n  }\n  if (/timed out/i.test(message)) return new ExecutionError(\"timeout\", message);\n  return new ExecutionError(\"unknown\", message, error instanceof Error ? error : undefined);\n}\n"]}

package/dist/harness/execution-resolver.d.ts

@@ -0,0 +1,25 @@
+import type { Workspace } from "../office/index.js";
+import { DockerContainerManager } from "../sandbox/provisioner.js";
+import { type SandboxConfig } from "../sandbox/index.js";
+import { type VaultManager } from "../vault/index.js";
+import type { WorkspaceProjection } from "../office/types.js";
+export type { ActorContext } from "../types.js";
+import type { ActorContext } from "../types.js";
+export declare class ActorExecutionResolver {
+    private baseConfig;
+    private vaultManager;
+    private provisioner;
+    private workspace;
+    constructor(baseConfig: SandboxConfig, vaultManager: VaultManager, provisioner: DockerContainerManager | undefined, workspace: Workspace);
+    resolve(context: ActorContext): Promise<{
+        executor: import("../sandbox/types.js").Executor;
+        pathContext: import("../sandbox/types.js").RuntimePathContext;
+        projection: WorkspaceProjection;
+    }>;
+    private resolvePlan;
+    private ensureDefaultSharedVault;
+    private resolveSandboxConfig;
+    private buildEnsureReadyCallback;
+    private resolveMounts;
+}
+//# sourceMappingURL=execution-resolver.d.ts.map

package/dist/harness/execution-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-resolver.d.ts","sourceRoot":"","sources":["../../src/harness/execution-resolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,sBAAsB,EAAuB,MAAM,2BAA2B,CAAC;AACxF,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAA4B,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAShF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,aAAa,CAAC;AAE/D,qBAAa,sBAAsB;IAE/B,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,WAAW;IACnB,OAAO,CAAC,SAAS;IAJnB,YACU,UAAU,EAAE,aAAa,EACzB,YAAY,EAAE,YAAY,EAC1B,WAAW,EAAE,sBAAsB,GAAG,SAAS,EAC/C,SAAS,EAAE,SAAS,EAC1B;IAEE,OAAO,CAAC,OAAO,EAAE,YAAY;;;;OAYlC;IAED,OAAO,CAAC,WAAW;IAuCnB,OAAO,CAAC,wBAAwB;IAuBhC,OAAO,CAAC,oBAAoB;IAc5B,OAAO,CAAC,wBAAwB;IA0ChC,OAAO,CAAC,aAAa;CA4BtB"}

package/dist/harness/execution-resolver.js

@@ -0,0 +1,156 @@
+import { posix } from "node:path";
+import { loadGlobalSettings } from "../settings/index.js";
+import { DockerContainerManager } from "../sandbox/provisioner.js";
+import { assertSandboxSupportsWorkspacePolicy, createExecutor, getSandboxCredentialCapabilities, } from "../sandbox/index.js";
+import { reportUserFacingError } from "../observability/index.js";
+import { normalizeSharedVaultName } from "../vault/index.js";
+import { allowsAmbientDefaultSharedVault, resolveVaultInjection } from "../vault/index.js";
+import { credentialAuthorizationKey, legacyExactCredentialAuthorizationKey, runtimeResourceKey, scopeCloudflareSandboxId, } from "../sandbox/identity.js";
+import { resolveWorkspaceProjection } from "../office/projection.js";
+export class ActorExecutionResolver {
+    constructor(baseConfig, vaultManager, provisioner, workspace) {
+        this.baseConfig = baseConfig;
+        this.vaultManager = vaultManager;
+        this.provisioner = provisioner;
+        this.workspace = workspace;
+    }
+    async resolve(context) {
+        const { plan, projection } = this.resolvePlan(context);
+        const executor = createExecutor(plan.sandboxConfig, plan.env, this.buildEnsureReadyCallback(plan, context.address.conversationId));
+        return {
+            executor,
+            pathContext: executor.getPathContext(this.workspace.root),
+            projection,
+        };
+    }
+    resolvePlan(context) {
+        const scope = { userId: context.userId, address: context.address };
+        const credentialKey = credentialAuthorizationKey(this.baseConfig, scope);
+        const legacyCredentialKey = legacyExactCredentialAuthorizationKey(this.baseConfig, scope);
+        const resourceKey = runtimeResourceKey(this.baseConfig, {
+            userId: context.userId,
+            address: context.address,
+        });
+        this.ensureDefaultSharedVault(credentialKey, legacyCredentialKey, context.trustModel);
+        const vault = this.vaultManager.resolve(credentialKey) ??
+            (legacyCredentialKey ? this.vaultManager.resolve(legacyCredentialKey) : undefined);
+        const capabilities = getSandboxCredentialCapabilities(this.baseConfig.type);
+        const office = this.workspace.office(context.address);
+        const projection = resolveWorkspaceProjection(office);
+        const injection = resolveVaultInjection({
+            vault,
+            capabilities,
+            sandboxType: this.baseConfig.type,
+            address: office.address,
+        });
+        const mounts = this.resolveMounts(injection.mounts, projection);
+        assertSandboxSupportsWorkspacePolicy(this.baseConfig, projection.visibility, office.key);
+        return {
+            plan: {
+                credentialKey,
+                resourceKey,
+                sandboxConfig: this.resolveSandboxConfig(resourceKey),
+                env: injection.env,
+                mounts,
+            },
+            projection,
+        };
+    }
+    ensureDefaultSharedVault(credentialKey, legacyCredentialKey, trustModel) {
+        if (!allowsAmbientDefaultSharedVault({ trustModel, sandboxType: this.baseConfig.type }))
+            return;
+        if (this.vaultManager.hasEntry(credentialKey) ||
+            (legacyCredentialKey && this.vaultManager.hasEntry(legacyCredentialKey))) {
+            return;
+        }
+        let profile;
+        try {
+            profile = loadGlobalSettings().sandbox?.defaultSharedVault;
+        }
+        catch {
+            return;
+        }
+        if (!profile || normalizeSharedVaultName(profile) !== profile)
+            return;
+        this.vaultManager.copySharedVaultTo(profile, credentialKey);
+    }
+    resolveSandboxConfig(resourceKey) {
+        if (this.baseConfig.type === "cloudflare") {
+            return {
+                type: "cloudflare",
+                sandboxId: scopeCloudflareSandboxId(this.baseConfig.sandboxId, resourceKey),
+            };
+        }
+        if (this.baseConfig.type !== "image")
+            return this.baseConfig;
+        return {
+            type: "container",
+            container: DockerContainerManager.containerName(resourceKey),
+        };
+    }
+    buildEnsureReadyCallback(plan, conversationId) {
+        if (this.baseConfig.type !== "image" || plan.sandboxConfig.type !== "container") {
+            return undefined;
+        }
+        return async () => {
+            const expected = plan.sandboxConfig.type === "container" ? plan.sandboxConfig.container : "";
+            let actual;
+            try {
+                actual = await this.provisioner?.provision(plan.resourceKey, {
+                    containerName: expected,
+                    mounts: plan.mounts,
+                    conversationId,
+                });
+            }
+            catch (err) {
+                reportUserFacingError(err, {
+                    domain: "sandbox",
+                    surface: "sandbox_provision",
+                    operation: "ensure_image_container_ready",
+                    severity: "error",
+                    context: {
+                        sandboxType: "image",
+                        conversationId,
+                        credentialKey: plan.credentialKey,
+                        resourceKey: plan.resourceKey,
+                        expectedContainer: expected,
+                        hasVault: Boolean(plan.env || plan.mounts.length > 0),
+                    },
+                });
+                throw err;
+            }
+            if (actual && actual !== expected) {
+                throw new Error(`Provisioner returned container "${actual}" for resource key "${plan.resourceKey}", expected "${expected}"`);
+            }
+        };
+    }
+    resolveMounts(vaultMounts, projection) {
+        const protectedMounts = projection.mounts;
+        for (let index = 0; index < vaultMounts.length; index += 1) {
+            const vaultMount = vaultMounts[index];
+            if (vaultMount === undefined)
+                continue;
+            const workspaceCollision = protectedMounts.find((protectedMount) => targetsOverlap(protectedMount.target, vaultMount.target));
+            if (workspaceCollision) {
+                throw new Error(`Vault mount target "${vaultMount.target}" overlaps protected workspace target "${workspaceCollision.target}"`);
+            }
+            const vaultCollision = vaultMounts
+                .slice(0, index)
+                .find((other) => targetsOverlap(other.target, vaultMount.target));
+            if (vaultCollision) {
+                throw new Error(`Vault mount target "${vaultMount.target}" overlaps vault target "${vaultCollision.target}"`);
+            }
+        }
+        return [...protectedMounts, ...vaultMounts];
+    }
+}
+function targetsOverlap(left, right) {
+    const a = normalizeMountTarget(left);
+    const b = normalizeMountTarget(right);
+    return a === b || a.startsWith(`${b}/`) || b.startsWith(`${a}/`);
+}
+function normalizeMountTarget(value) {
+    const normalized = posix.normalize(value);
+    return normalized.replace(/\/+$/, "") || "/";
+}
+//# sourceMappingURL=execution-resolver.js.map

package/dist/harness/execution-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-resolver.js","sourceRoot":"","sources":["../../src/harness/execution-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAuB,MAAM,2BAA2B,CAAC;AACxF,OAAO,EACL,oCAAoC,EACpC,cAAc,EACd,gCAAgC,GAEjC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAqB,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAAE,+BAA+B,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EACL,0BAA0B,EAC1B,qCAAqC,EACrC,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAMrE,MAAM,OAAO,sBAAsB;IACjC,YACU,UAAyB,EACzB,YAA0B,EAC1B,WAA+C,EAC/C,SAAoB;0BAHpB,UAAU;4BACV,YAAY;2BACZ,WAAW;yBACX,SAAS;IAChB,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,OAAqB;QACjC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,cAAc,CAC7B,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,GAAG,EACR,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CACpE,CAAC;QACF,OAAO;YACL,QAAQ;YACR,WAAW,EAAE,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YACzD,UAAU;SACX,CAAC;IACJ,CAAC;IAEO,WAAW,CAAC,OAAqB;QAIvC,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QACnE,MAAM,aAAa,GAAG,0BAA0B,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACzE,MAAM,mBAAmB,GAAG,qCAAqC,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC1F,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE;YACtD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QACH,IAAI,CAAC,wBAAwB,CAAC,aAAa,EAAE,mBAAmB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAEtF,MAAM,KAAK,GACT,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC;YACxC,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACrF,MAAM,YAAY,GAAG,gCAAgC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,qBAAqB,CAAC;YACtC,KAAK;YACL,YAAY;YACZ,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;YACjC,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAChE,oCAAoC,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QACzF,OAAO;YACL,IAAI,EAAE;gBACJ,aAAa;gBACb,WAAW;gBACX,aAAa,EAAE,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC;gBACrD,GAAG,EAAE,SAAS,CAAC,GAAG;gBAClB,MAAM;aACP;YACD,UAAU;SACX,CAAC;IACJ,CAAC;IAEO,wBAAwB,CAC9B,aAAqB,EACrB,mBAAuC,EACvC,UAAsC;QAEtC,IAAI,CAAC,+BAA+B,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAAE,OAAO;QAChG,IACE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC;YACzC,CAAC,mBAAmB,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,EACxE,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC;YACH,OAAO,GAAG,kBAAkB,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,wBAAwB,CAAC,OAAO,CAAC,KAAK,OAAO;YAAE,OAAO;QACtE,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC9D,CAAC;IAEO,oBAAoB,CAAC,WAAmB;QAC9C,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC1C,OAAO;gBACL,IAAI,EAAE,YAAY;gBAClB,SAAS,EAAE,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC;aAC5E,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;QAC7D,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,SAAS,EAAE,sBAAsB,CAAC,aAAa,CAAC,WAAW,CAAC;SAC7D,CAAC;IACJ,CAAC;IAEO,wBAAwB,CAC9B,IAAmB,EACnB,cAAsB;QAEtB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChF,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,KAAK,IAAI,EAAE;YAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,IAAI,MAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE;oBAC3D,aAAa,EAAE,QAAQ;oBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,qBAAqB,CAAC,GAAG,EAAE;oBACzB,MAAM,EAAE,SAAS;oBACjB,OAAO,EAAE,mBAAmB;oBAC5B,SAAS,EAAE,8BAA8B;oBACzC,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE;wBACP,WAAW,EAAE,OAAO;wBACpB,cAAc;wBACd,aAAa,EAAE,IAAI,CAAC,aAAa;wBACjC,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,iBAAiB,EAAE,QAAQ;wBAC3B,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;qBACtD;iBACF,CAAC,CAAC;gBACH,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,IAAI,MAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,uBAAuB,IAAI,CAAC,WAAW,gBAAgB,QAAQ,GAAG,CAC5G,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAEO,aAAa,CACnB,WAA6B,EAC7B,UAA+B;QAE/B,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC;QAC1C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC3D,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,UAAU,KAAK,SAAS;gBAAE,SAAS;YACvC,MAAM,kBAAkB,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,EAAE,CACjE,cAAc,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CACzD,CAAC;YACF,IAAI,kBAAkB,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CACb,uBAAuB,UAAU,CAAC,MAAM,0CAA0C,kBAAkB,CAAC,MAAM,GAAG,CAC/G,CAAC;YACJ,CAAC;YAED,MAAM,cAAc,GAAG,WAAW;iBAC/B,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;iBACf,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YACpE,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CACb,uBAAuB,UAAU,CAAC,MAAM,4BAA4B,cAAc,CAAC,MAAM,GAAG,CAC7F,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,eAAe,EAAE,GAAG,WAAW,CAAC,CAAC;IAC9C,CAAC;CACF;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa;IACjD,MAAM,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1C,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;AAC/C,CAAC","sourcesContent":["import { posix } from \"node:path\";\nimport type { Workspace } from \"../office/index.js\";\nimport { loadGlobalSettings } from \"../settings/index.js\";\nimport { DockerContainerManager, type ContainerMount } from \"../sandbox/provisioner.js\";\nimport {\n  assertSandboxSupportsWorkspacePolicy,\n  createExecutor,\n  getSandboxCredentialCapabilities,\n  type SandboxConfig,\n} from \"../sandbox/index.js\";\nimport { reportUserFacingError } from \"../observability/index.js\";\nimport { normalizeSharedVaultName, type VaultManager } from \"../vault/index.js\";\nimport { allowsAmbientDefaultSharedVault, resolveVaultInjection } from \"../vault/index.js\";\nimport {\n  credentialAuthorizationKey,\n  legacyExactCredentialAuthorizationKey,\n  runtimeResourceKey,\n  scopeCloudflareSandboxId,\n} from \"../sandbox/identity.js\";\nimport { resolveWorkspaceProjection } from \"../office/projection.js\";\nimport type { WorkspaceProjection } from \"../office/types.js\";\n\nexport type { ActorContext } from \"../types.js\";\nimport type { ActorContext, ExecutionPlan } from \"../types.js\";\n\nexport class ActorExecutionResolver {\n  constructor(\n    private baseConfig: SandboxConfig,\n    private vaultManager: VaultManager,\n    private provisioner: DockerContainerManager | undefined,\n    private workspace: Workspace,\n  ) {}\n\n  async resolve(context: ActorContext) {\n    const { plan, projection } = this.resolvePlan(context);\n    const executor = createExecutor(\n      plan.sandboxConfig,\n      plan.env,\n      this.buildEnsureReadyCallback(plan, context.address.conversationId),\n    );\n    return {\n      executor,\n      pathContext: executor.getPathContext(this.workspace.root),\n      projection,\n    };\n  }\n\n  private resolvePlan(context: ActorContext): {\n    plan: ExecutionPlan;\n    projection: WorkspaceProjection;\n  } {\n    const scope = { userId: context.userId, address: context.address };\n    const credentialKey = credentialAuthorizationKey(this.baseConfig, scope);\n    const legacyCredentialKey = legacyExactCredentialAuthorizationKey(this.baseConfig, scope);\n    const resourceKey = runtimeResourceKey(this.baseConfig, {\n      userId: context.userId,\n      address: context.address,\n    });\n    this.ensureDefaultSharedVault(credentialKey, legacyCredentialKey, context.trustModel);\n\n    const vault =\n      this.vaultManager.resolve(credentialKey) ??\n      (legacyCredentialKey ? this.vaultManager.resolve(legacyCredentialKey) : undefined);\n    const capabilities = getSandboxCredentialCapabilities(this.baseConfig.type);\n    const office = this.workspace.office(context.address);\n    const projection = resolveWorkspaceProjection(office);\n    const injection = resolveVaultInjection({\n      vault,\n      capabilities,\n      sandboxType: this.baseConfig.type,\n      address: office.address,\n    });\n    const mounts = this.resolveMounts(injection.mounts, projection);\n    assertSandboxSupportsWorkspacePolicy(this.baseConfig, projection.visibility, office.key);\n    return {\n      plan: {\n        credentialKey,\n        resourceKey,\n        sandboxConfig: this.resolveSandboxConfig(resourceKey),\n        env: injection.env,\n        mounts,\n      },\n      projection,\n    };\n  }\n\n  private ensureDefaultSharedVault(\n    credentialKey: string,\n    legacyCredentialKey: string | undefined,\n    trustModel: ActorContext[\"trustModel\"],\n  ): void {\n    if (!allowsAmbientDefaultSharedVault({ trustModel, sandboxType: this.baseConfig.type })) return;\n    if (\n      this.vaultManager.hasEntry(credentialKey) ||\n      (legacyCredentialKey && this.vaultManager.hasEntry(legacyCredentialKey))\n    ) {\n      return;\n    }\n\n    let profile: string | undefined;\n    try {\n      profile = loadGlobalSettings().sandbox?.defaultSharedVault;\n    } catch {\n      return;\n    }\n    if (!profile || normalizeSharedVaultName(profile) !== profile) return;\n    this.vaultManager.copySharedVaultTo(profile, credentialKey);\n  }\n\n  private resolveSandboxConfig(resourceKey: string): SandboxConfig {\n    if (this.baseConfig.type === \"cloudflare\") {\n      return {\n        type: \"cloudflare\",\n        sandboxId: scopeCloudflareSandboxId(this.baseConfig.sandboxId, resourceKey),\n      };\n    }\n    if (this.baseConfig.type !== \"image\") return this.baseConfig;\n    return {\n      type: \"container\",\n      container: DockerContainerManager.containerName(resourceKey),\n    };\n  }\n\n  private buildEnsureReadyCallback(\n    plan: ExecutionPlan,\n    conversationId: string,\n  ): (() => Promise<void>) | undefined {\n    if (this.baseConfig.type !== \"image\" || plan.sandboxConfig.type !== \"container\") {\n      return undefined;\n    }\n\n    return async () => {\n      const expected = plan.sandboxConfig.type === \"container\" ? plan.sandboxConfig.container : \"\";\n      let actual: string | undefined;\n      try {\n        actual = await this.provisioner?.provision(plan.resourceKey, {\n          containerName: expected,\n          mounts: plan.mounts,\n          conversationId,\n        });\n      } catch (err) {\n        reportUserFacingError(err, {\n          domain: \"sandbox\",\n          surface: \"sandbox_provision\",\n          operation: \"ensure_image_container_ready\",\n          severity: \"error\",\n          context: {\n            sandboxType: \"image\",\n            conversationId,\n            credentialKey: plan.credentialKey,\n            resourceKey: plan.resourceKey,\n            expectedContainer: expected,\n            hasVault: Boolean(plan.env || plan.mounts.length > 0),\n          },\n        });\n        throw err;\n      }\n      if (actual && actual !== expected) {\n        throw new Error(\n          `Provisioner returned container \"${actual}\" for resource key \"${plan.resourceKey}\", expected \"${expected}\"`,\n        );\n      }\n    };\n  }\n\n  private resolveMounts(\n    vaultMounts: ContainerMount[],\n    projection: WorkspaceProjection,\n  ): ContainerMount[] {\n    const protectedMounts = projection.mounts;\n    for (let index = 0; index < vaultMounts.length; index += 1) {\n      const vaultMount = vaultMounts[index];\n      if (vaultMount === undefined) continue;\n      const workspaceCollision = protectedMounts.find((protectedMount) =>\n        targetsOverlap(protectedMount.target, vaultMount.target),\n      );\n      if (workspaceCollision) {\n        throw new Error(\n          `Vault mount target \"${vaultMount.target}\" overlaps protected workspace target \"${workspaceCollision.target}\"`,\n        );\n      }\n\n      const vaultCollision = vaultMounts\n        .slice(0, index)\n        .find((other) => targetsOverlap(other.target, vaultMount.target));\n      if (vaultCollision) {\n        throw new Error(\n          `Vault mount target \"${vaultMount.target}\" overlaps vault target \"${vaultCollision.target}\"`,\n        );\n      }\n    }\n    return [...protectedMounts, ...vaultMounts];\n  }\n}\n\nfunction targetsOverlap(left: string, right: string): boolean {\n  const a = normalizeMountTarget(left);\n  const b = normalizeMountTarget(right);\n  return a === b || a.startsWith(`${b}/`) || b.startsWith(`${a}/`);\n}\n\nfunction normalizeMountTarget(value: string): string {\n  const normalized = posix.normalize(value);\n  return normalized.replace(/\\/+$/, \"\") || \"/\";\n}\n"]}

package/dist/harness/index.d.ts

@@ -1,19 +1,24 @@
 /**
  * mikan agent harness.
  *
- * mikan's own harness engineering layer, built directly on pi-agent-core
- * (agent loop, compaction, context building) and pi-ai (providers, models,
- * auth). See `src/harness/README.md` for the architecture.
+ * Application integration of pi-agent-core's native AgentHarness (durable
+ * operations, tools, retries, compaction, recovery) and pi-ai (providers,
+ * models, auth). See `src/harness/README.md` for the architecture.
  */
-export { FileCredentialStore, defaultAuthPath } from "./auth.js";
 export { DEFAULT_HTTP_IDLE_TIMEOUT_MS, configureHttpDispatcher, parseHttpIdleTimeoutMs, } from "./http.js";
-export { MikanModels, defaultModelsJsonPath, type CreateMikanModelsOptions } from "./models.js";
-export { SessionStore, loadSessionFileEntries, parseSessionFileEntries } from "./session-store.js";
-export { MikanAgentSession, type CompactionReason, type HarnessEvent, type HarnessEventListener, type MikanAgentSessionOptions, } from "./runner.js";
-export { formatSkillsForPrompt, loadSkillsFromDir, parseFrontmatter, type LoadSkillsResult, type MikanSkill, type SkillDiagnostic, } from "./skills.js";
-export { DEFAULT_BUDGET_SETTINGS, DEFAULT_EVENT_BUDGET, DEFAULT_RETRY_SETTINGS, resolveHarnessSettings, type BudgetSettings, type CompactionSettings, type HarnessSettings, type RetrySettings, } from "./settings.js";
-export { ExtensionRegistry } from "./extensions/registry.js";
-export { defaultExtensionDirs, extensionSlug, listInstalledExtensions, loadExtensions, validateExtension, type ExtensionValidation, type InstalledExtensionInfo, type LoadExtensionsOptions, type LoadExtensionsResult, } from "./extensions/loader.js";
-export type { BeforeAgentStartHookEvent, BeforeAgentStartHookResult, ExtensionHostServices, ExtensionLoadError, ExtensionManifest, ExtensionScheduleInfo, ExtensionSchedulePayload, ExtensionScheduleSpec, ExtensionScheduleStore, LoadedExtension, MessageEndHookEvent, MikanExtensionActivate, MikanExtensionApi, MikanExtensionModule, MikanHookMap, MikanHookName, SessionCompactHookEvent, ToolCallHookEvent, ToolCallHookResult, ToolResultHookEvent, TurnEndHookEvent, } from "./extensions/types.js";
-export { CURRENT_SESSION_VERSION, type BranchSummaryEntry, type CompactionEntry, type CustomEntry, type CustomMessageEntry, type SessionContext, type SessionEntry, type SessionFileEntry, type SessionHeader, type SessionInfoEntry, type SessionMessageEntry, } from "./types.js";
+export { MikanModels, defaultModelsJsonPath } from "./models.js";
+export type { CreateMikanModelsOptions } from "./types.js";
+export { JEV_MODEL_ID, JevNotConfiguredError, JevRequestError, evaluateWithJev, type EvaluateWithJevOptions, type JevAnswer, type JevEntry, type JevQuestion, type JevQuestions, type JevResult, } from "./jev.js";
+export { SessionStore } from "../sessions/session-store.js";
+export type { SessionContext, SessionEntry, SessionHeader, SessionMessageEntry, } from "../sessions/types.js";
+export { CURRENT_SESSION_VERSION } from "../sessions/types.js";
+export { MikanAgentSession } from "./session.js";
+export type { CompactionReason, HarnessEvent, HarnessEventListener, MikanAgentSessionOptions, } from "./types.js";
+export { formatSkillsForPrompt, loadSkillsFromDir, parseFrontmatter } from "./skills.js";
+export type { LoadSkillsResult, MikanSkill, SkillDiagnostic } from "./types.js";
+export { loadSubagentProfiles } from "./subagent-profiles.js";
+export type { LoadSubagentProfilesResult, SubagentProfileDiagnostic } from "./types.js";
+export { DEFAULT_BUDGET_SETTINGS, DEFAULT_EVENT_BUDGET, DEFAULT_RETRY_SETTINGS, resolveHarnessSettings, type CompactionSettings, } from "./session.js";
+export type { BudgetSettings, HarnessSettings, RetrySettings } from "./types.js";
+export { type SubagentModelSpec, type SubagentProfile, type SubagentParentContext, type SubagentRunBudget, type SubagentRunOutput, type SubagentRunRequest, type SubagentRunResult, type SubagentRunStatus, type SubagentUsage, type SubagentUsageSink, type BranchSummaryEntry, type CompactionEntry, type CustomEntry, } from "./types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/harness/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/harness/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,KAAK,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAChG,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AACnG,OAAO,EACL,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,GAC9B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,aAAa,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC1B,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,wBAAwB,EACxB,qBAAqB,EACrB,sBAAsB,EACtB,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,YAAY,EACZ,aAAa,EACb,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,GACzB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/harness/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACjE,YAAY,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,KAAK,sBAAsB,EAC3B,KAAK,SAAS,EACd,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,YAAY,EACV,cAAc,EACd,YAAY,EACZ,aAAa,EACb,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACzF,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AACxF,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,kBAAkB,GACxB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACjF,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC"}

package/dist/harness/index.js

@@ -1,18 +1,18 @@
 /**
  * mikan agent harness.
  *
- * mikan's own harness engineering layer, built directly on pi-agent-core
- * (agent loop, compaction, context building) and pi-ai (providers, models,
- * auth). See `src/harness/README.md` for the architecture.
+ * Application integration of pi-agent-core's native AgentHarness (durable
+ * operations, tools, retries, compaction, recovery) and pi-ai (providers,
+ * models, auth). See `src/harness/README.md` for the architecture.
  */
-export { FileCredentialStore, defaultAuthPath } from "./auth.js";
 export { DEFAULT_HTTP_IDLE_TIMEOUT_MS, configureHttpDispatcher, parseHttpIdleTimeoutMs, } from "./http.js";
 export { MikanModels, defaultModelsJsonPath } from "./models.js";
-export { SessionStore, loadSessionFileEntries, parseSessionFileEntries } from "./session-store.js";
-export { MikanAgentSession, } from "./runner.js";
-export { formatSkillsForPrompt, loadSkillsFromDir, parseFrontmatter, } from "./skills.js";
-export { DEFAULT_BUDGET_SETTINGS, DEFAULT_EVENT_BUDGET, DEFAULT_RETRY_SETTINGS, resolveHarnessSettings, } from "./settings.js";
-export { ExtensionRegistry } from "./extensions/registry.js";
-export { defaultExtensionDirs, extensionSlug, listInstalledExtensions, loadExtensions, validateExtension, } from "./extensions/loader.js";
-export { CURRENT_SESSION_VERSION, } from "./types.js";
+export { JEV_MODEL_ID, JevNotConfiguredError, JevRequestError, evaluateWithJev, } from "./jev.js";
+export { SessionStore } from "../sessions/session-store.js";
+export { CURRENT_SESSION_VERSION } from "../sessions/types.js";
+export { MikanAgentSession } from "./session.js";
+export { formatSkillsForPrompt, loadSkillsFromDir, parseFrontmatter } from "./skills.js";
+export { loadSubagentProfiles } from "./subagent-profiles.js";
+export { DEFAULT_BUDGET_SETTINGS, DEFAULT_EVENT_BUDGET, DEFAULT_RETRY_SETTINGS, resolveHarnessSettings, } from "./session.js";
+export {} from "./types.js";
 //# sourceMappingURL=index.js.map